Offline Log archival process
The logs are currently stored in the 2.7TB NAS and we will run out of disk space down the line. Here is the high-level architecture. We have three RSA enVision (Win2k3) servers and one storage box in our primary datacenter and one RSA server (remote collector) in secondary DC. Log collection and processing is done by the servers and stored directly in the NAS. Four volumes are created in the NAS (vol0, vol1, vol2 & vol3) and the following storage space is allocated to each volume:
vol0 - 935.50GB
vol1 - 679.47GB
vol2 - 679.47GB
vol3 - 679.47GB
Currently vol1 is almost full and we wish to backup this data in a tape. The logs are stored in RSA custom file format. Please share with me how do you accomplish backup of logs in your organization or do you simply purge the logs on a periodic basis.
To give you some more information, we plan to implement TSM backup (with supported by RSA) on our envision Data-Srv and Local Collector (LC), we plan to have the TSM traverse the NAS that is mapped to D-Srv and LC and backup all files automatically that are more than six months old, TSM will be scheduled to do this activity over the weekend off business hours. In the event there is a need to restore the logs, we can restore the files from the tape and put it back in the NAS or some other storage.
When I issue the command lsmaint -show -gmt -time start -6M, the output displays all files from NAS that are more than 6 months old which is great. I was wondering on what basis lsmaint does the search, does lsmaint, look into the last modified attribute of the file to gather this info? The reason I ask is because, TSM will be configured to proactively backup all files that are more than six months old to offline tapes and TSM decides the age of the file by looking at the last modified attribute of the file. Once the TSM backup is complete, we'll issue the lsmaint -delete -gmt -time start -6M to delete the files. I wanted to ensure that the basis on which TSM searches and backs up the files is in sync with Lsmaint.exe. Hope you understand what I'm asking...thanks for all your help.